chore: extend lint coverage to the fuzz and wasm paths (#410)

Author: mmorrissette-devolutions

.github/workflows/formatting/rust/action.yml

@@ -11,6 +11,7 @@ runs:
       shell: bash
       run: |
         rustup update
+        rustup target add wasm32-unknown-unknown
 
     - name: Check Format
       working-directory: ./
@@ -21,3 +22,15 @@ runs:
       working-directory: ./
       shell: bash
       run: cargo clippy --workspace --all-targets -- -D warnings
+
+    - name: Check Clippy (fuzz feature)
+      working-directory: ./
+      shell: bash
+      run: cargo clippy --all-targets --features fuzz -- -D warnings
+
+    # The wbindgen deps live under [target.wasm32-unknown-unknown.dependencies],
+    # so this feature only resolves against the wasm target.
+    - name: Check Clippy (wasm bindings)
+      working-directory: ./
+      shell: bash
+      run: cargo clippy --target wasm32-unknown-unknown --features wbindgen --all-targets -- -D warnings

fuzz/Cargo.toml

@@ -20,163 +20,286 @@ features = ["fuzz"]
 [[bin]]
 name = "ciphertext_deserialization"
 path = "fuzz_targets/ciphertext/ciphertext_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "encrypt"
 path = "fuzz_targets/ciphertext/encrypt.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "encrypt_asymmetric"
 path = "fuzz_targets/ciphertext/encrypt_asymmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "decrypt"
 path = "fuzz_targets/ciphertext/decrypt.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "decrypt_asymmetric"
 path = "fuzz_targets/ciphertext/decrypt_asymmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "password_hash_deserialization"
 path = "fuzz_targets/password_hash/password_hash_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "public_key_deserialization"
 path = "fuzz_targets/key/public_key_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "private_key_deserialization"
 path = "fuzz_targets/key/private_key_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "argon2parameters_deserialization"
 path = "fuzz_targets/key/argon2parameters_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "mix_key_exchange"
 path = "fuzz_targets/key/mix_key_exchange.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "share_deserialization"
 path = "fuzz_targets/secret_sharing/share_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "generate_shared_key"
 path = "fuzz_targets/secret_sharing/generate_shared_key.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "join_shares"
 path = "fuzz_targets/secret_sharing/join_shares.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "generate_key"
 path = "fuzz_targets/utils/generate_key.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "derive_key"
 path = "fuzz_targets/utils/derive_key.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "validate_header"
 path = "fuzz_targets/utils/validate_header.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "base64_encode"
 path = "fuzz_targets/utils/base64_encode.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "base64_encode_url"
 path = "fuzz_targets/utils/base64_encode_url.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "base64_decode"
 path = "fuzz_targets/utils/base64_decode.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "base64_decode_url"
 path = "fuzz_targets/utils/base64_decode_url.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "derive_key_argon2"
 path = "fuzz_targets/utils/derive_key_argon2.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "scrypt_simple"
 path = "fuzz_targets/utils/scrypt_simple.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "signature_deserialization"
 path = "fuzz_targets/signature/signature_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "sign"
 path = "fuzz_targets/signature/sign.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "verify"
 path = "fuzz_targets/signature/verify.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "signing_keypair_deserialization"
 path = "fuzz_targets/signing_key/signing_keypair_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "signing_public_key_deserialization"
 path = "fuzz_targets/signing_key/signing_public_key_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "online_ciphertext_header_deserialization"
 path = "fuzz_targets/online_ciphertext/header_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "online_encrypt_symmetric"
 path = "fuzz_targets/online_ciphertext/encrypt_symmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "online_encrypt_asymmetric"
 path = "fuzz_targets/online_ciphertext/encrypt_asymmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "online_decrypt_symmetric"
 path = "fuzz_targets/online_ciphertext/decrypt_symmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "online_decrypt_asymmetric"
 path = "fuzz_targets/online_ciphertext/decrypt_asymmetric.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "encrypt_with_aad"
 path = "fuzz_targets/ciphertext/encrypt_with_aad.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "decrypt_with_aad"
 path = "fuzz_targets/ciphertext/decrypt_with_aad.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "encrypt_asymmetric_with_aad"
 path = "fuzz_targets/ciphertext/encrypt_asymmetric_with_aad.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "decrypt_asymmetric_with_aad"
 path = "fuzz_targets/ciphertext/decrypt_asymmetric_with_aad.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "generate_keypair"
 path = "fuzz_targets/key/generate_keypair.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "constant_time_equals"
 path = "fuzz_targets/utils/constant_time_equals.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "kdf_encrypted_data_deserialization"
 path = "fuzz_targets/derive_encrypt/kdf_encrypted_data_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "derivation_parameters_deserialization"
 path = "fuzz_targets/key_derivation/derivation_parameters_deserialization.rs"
+test = false
+doc = false
+bench = false
 
 [[bin]]
 name = "decrypt_with_password"
 path = "fuzz_targets/derive_encrypt/decrypt_with_password.rs"
+test = false
+doc = false
+bench = false

src/error.rs

@@ -10,17 +10,6 @@ use hmac::digest::MacError;
 
 pub type Result<T> = std::result::Result<T, Error>;
 
-// Doesn't work because Result is a type alias, keeping the commented code just in case we revisit someday
-// impl<T, E> From<std::result::Result<T, E>> for Result<T>
-// where E: Into<Error> {
-//    fn from(value: std::result::Result<T, E>) -> Self {
-//         match value {
-//             Ok(t) => Ok(t),
-//             Err(e) => Err(e.into()),
-//         }
-//     }
-// }
-
 /// This crate's error type.
 #[derive(Debug, IntoStaticStr, thiserror::Error)]
 pub enum Error {

src/password_hash/password_hash_v1.rs

@@ -85,7 +85,8 @@ impl PasswordHashV1 {
 
         // Generate hash
         let mut hash = [0u8; 32];
-        let _ = pbkdf2::<Hmac<Sha256>>(pass, &salt, iterations, &mut hash);
+        pbkdf2::<Hmac<Sha256>>(pass, &salt, iterations, &mut hash)
+            .expect("HMAC-SHA256 accepts keys of any length, so this cannot fail");
 
         Ok(PasswordHashV1 {
             iterations,
@@ -96,7 +97,8 @@ impl PasswordHashV1 {
 
     pub fn verify_password(&self, pass: &[u8]) -> bool {
         let mut res = Zeroizing::new(vec![0u8; 32]);
-        let _ = pbkdf2::<Hmac<Sha256>>(pass, &self.salt, self.iterations, &mut res);
+        pbkdf2::<Hmac<Sha256>>(pass, &self.salt, self.iterations, &mut res)
+            .expect("HMAC-SHA256 accepts keys of any length, so this cannot fail");
 
         res.ct_eq(&self.hash).into()
     }

src/utils.rs

@@ -73,7 +73,8 @@ pub(crate) fn random_bytes<const N: usize>() -> Result<Zeroizing<[u8; N]>> {
 /// ```
 pub fn derive_key_pbkdf2(key: &[u8], salt: &[u8], iterations: u32, length: usize) -> Vec<u8> {
     let mut new_key = vec![0u8; length];
-    let _ = pbkdf2::<Hmac<Sha256>>(key, salt, iterations, &mut new_key);
+    pbkdf2::<Hmac<Sha256>>(key, salt, iterations, &mut new_key)
+        .expect("HMAC-SHA256 accepts keys of any length, so this cannot fail");
     new_key
 }
 
@@ -103,16 +104,20 @@ pub fn derive_key_argon2(key: &[u8], parameters: &Argon2Parameters) -> Result<Ve
 /// # Returns
 /// `true` if the header is valid, `false` if it is not.
 /// # Example
+/// ```
 /// use devolutions_crypto::DataType;
 /// use devolutions_crypto::ciphertext::{encrypt, CiphertextVersion};
 /// use devolutions_crypto::utils::{generate_key, validate_header};
 ///
-/// let key = generate_key(32);
-/// let ciphertext: `Vec<u8>` = encrypt(b"test", &key, CiphertextVersion::Latest).unwrap().into();
+/// let key = generate_key(32).expect("generate key shouldn't fail");
+/// let ciphertext: Vec<u8> = encrypt(b"test", &key, CiphertextVersion::Latest)
+///     .expect("encryption shouldn't fail")
+///     .into();
 ///
-/// assert!(validate_header(&ciphertext, DataType::Ciphertext);
-/// assert!(!validate_header(&ciphertext, DataType::PasswordHash);
-/// assert!(!validate_header(&key, DataType::Ciphertext);
+/// assert!(validate_header(&ciphertext, DataType::Ciphertext));
+/// assert!(!validate_header(&ciphertext, DataType::PasswordHash));
+/// assert!(!validate_header(&key, DataType::Ciphertext));
+/// ```
 pub fn validate_header(data: &[u8], data_type: DataType) -> bool {
     use super::ciphertext::Ciphertext;
     use super::derive_encrypt::KdfEncryptedData;